Is it safe to connect your meeting notes to AI? What MCP shares and what it doesn't

TL;DR: Connecting your meeting notes to AI is safe when the tool uses authenticated, encrypted transport and keeps access read-only. Granola's MCP integration uses Streamable HTTP with OAuth 2.0 authentication. Granola transcribes in real time on macOS and Windows and doesn’t store the audio from meetings. If you have a meeting via mobile, Granola temporarily caches the audio but then only stores the transcript. Third-party AI providers are contractually prohibited from training on your data. You control what AI tools can see, and you can revoke access at any time.

When you connect meeting notes to AI tools, you need those tools to access past conversations without exposing sensitive discussions to unprotected endpoints. The Model Context Protocol, an open standard for AI context sharing introduced in late 2024, addresses this by defining how AI tools access your data with clear, auditable permissions. This guide explains exactly how that works and what stays private.

How MCP processes your meeting data

Transport methods and attack surface

MCP uses different transport methods that behave differently from a security perspective. Understanding the landscape helps you evaluate any AI tool's claims, not just Granola's.

• stdio transport keeps everything on your device. When a compatible AI tool connects to a local data source via stdio, it does so through standard input and output streams with no network port opened. No data travels to a remote endpoint to establish the connection. The server process terminates automatically when you close the application. This approach works well for local file system access and IDE integrations.
• SSE (Server-Sent Events) transport works over HTTP, requiring a persistent network connection. SSE is useful for distributed systems but carries a larger attack surface. The MCP specification officially deprecated SSE in its 2025 update, replacing it with Streamable HTTP.
• Streamable HTTP transport is the current MCP standard, handling both local and remote deployments. The MCP specification treats OAuth 2.0 authorization as a separate layer on top of the transport rather than a built-in requirement. Individual implementations choose whether to apply it. Granola requires OAuth 2.0 authentication for every connection, meaning each AI tool must receive explicit user authorization before it can query any notes.

Granola's MCP integration operates via Streamable HTTP with OAuth 2.0 authentication. Every AI tool you connect must authenticate individually before it can query any notes, and that access is scoped to exactly what you authorize.

How Granola handles audio after your meeting

The most important privacy fact about Granola is architectural: Granola transcribes meetings in real time on macOS and Windows without storing the meeting audio. On mobile, Granola temporarily caches the audio during the meeting, but only retains the resulting transcript.

Platform-specific handling is detailed in the transcription documentation, but across all supported platforms, no audio file remains on Granola's servers after transcription is complete.

This matters across all meeting types: when someone shares something sensitive in a deal discussion, a confidential briefing, a hiring conversation, or a customer research call, that audio does not persist anywhere. The only thing that persists is the text reflecting what mattered in the conversation.

How MCP protects your meeting content

How MCP reads your notes

MCP acts as a read-only bridge between your stored notes and your AI tools. Here is what happens when you ask Claude to surface themes from a set of meetings:

1. Claude initiates an authenticated request to Granola's MCP endpoint using your OAuth 2.0 token
2. Granola's MCP server verifies the request against your authorized scopes
3. Matching notes are returned through the encrypted connection
4. Your underlying notes stay exactly where they were, with no copying to a third-party database

Per-application OAuth authorization

Each AI tool connecting to Granola's MCP must complete an individual OAuth 2.0 authorization flow. This means a new application cannot silently gain access to your meeting notes: it must request permission, and you must grant it explicitly.

Using Granola's official first-party MCP connector, available through Claude, ChatGPT, Cursor, Figma, Copilot, Mistral, and Grok, means going through a controlled integration process rather than an unverified community package.

Our policy on partner data access

We contractually prohibit third-party AI providers from training on your data. This restriction applies to every partner who processes your notes, and it is enforceable, not a preference buried in a terms-of-service update.

Data MCP deliberately excludes from AI

Scope of MCP access

MCP shares finalized notes and transcripts only. It will not share raw audio, because that audio no longer exists by the time any AI query runs. The connection is read-only and scoped to completed meeting records.

This has a practical implication: you can end a meeting, review your rough notes, delete anything too sensitive to store before enhancement, and then connect your AI tools to what remains.

Editing and redacting before AI access

Before your notes become available to MCP-connected AI tools, you can edit, redact, or delete them. If a participant shared something they later asked you to remove, or if a note contains personally identifiable information you do not want stored, you remove it before any AI tool can query it. See our guide for how deletion works.

Ensuring your meeting data stays secure

Granola's settings give you control over which AI tools have MCP access and what scopes each connection carries. When you authorize a tool via the OAuth 2.0 flow, you choose between two scopes: Personal notes, which limits the connection to your own private meeting records, and Public notes, which also includes notes in shared team folders. This granularity means you do not need to grant broad access to get useful results.

Three actions stay fully in your hands:

• Deleting a meeting record: Permanently removes it from both local storage and Granola's servers. Because no audio file exists, a right-to-be-forgotten request for a participant means deleting the transcript and notes directly from within the app.
• Revoking MCP access: Navigate to Granola settings, find the connected tool under integrations, and disable the connection. Revocation takes effect according to your identity provider's token lifecycle management.
• Scoping new connections: When you authorize a tool through the OAuth 2.0 flow, you choose which scope it receives: Personal notes or Public notes, limiting what each connected tool can reach.

Managing access to sensitive meetings

Distinguishing read and write permissions

Granola's MCP server is read-only by design. Connected AI tools like Claude or ChatGPT can query your notes to generate summaries, follow-up actions, or cross-meeting themes, but they cannot modify, overwrite, or delete your original records. This is an architectural constraint, not a setting you can accidentally misconfigure.

The same control that makes that query possible also lets you scope it precisely. Disconnect a specific tool instantly through settings, or delete a transcript segment before any AI tool has an opportunity to query it.

Stopping AI access to notes

To stop a connected AI tool from accessing your notes, open Granola settings, navigate to integrations, and disable the connection for that specific tool. Revocation takes effect according to your identity provider's token lifecycle management. No support request is required.

Encryption and compliance

Encryption and data privacy

Notes are stored in our US-hosted AWS Virtual Private Cloud, encrypted at rest and in transit. Details are available on the Granola security page. Your notes remain private by default: colleagues cannot access your meeting records unless you share a link or add a note to a shared team folder. Personal research archives stay personal unless you make a deliberate choice to move them into a shared space.

Why our SOC 2 status matters

Granola achieved SOC 2 Type 2 compliance, completing the audit in three months. We accelerated that timeline by deleting audio immediately after transcription, which reduced the scope of data under audit. Fewer sensitive data categories meant fewer controls for auditors to assess.

For teams that need to share compliance documentation with their security or legal teams, SOC 2 Type 2 means an independent auditor reviewed our security practices over a sustained period and confirmed they meet the criteria for customer data privacy and confidentiality as ongoing practice, not just at a point in time. Teams evaluating Granola can use this documentation as part of their internal approval process.

Ensuring participant privacy during calls

We built two transparency features specifically to keep participants informed. The first is an automated chat message: Granola posts a notification in your meeting chat when it starts transcribing, visible to all participants without interrupting the conversation. The second is a Granola Watermark, a visible indicator on your video showing that Granola is transcribing. The watermark stays present throughout the call so late joiners also see it. You can enable one or both, for yourself or across your team.

Try Granola for free: Download the Mac or Windows app, connect your calendar, and run your next meeting to see how your notes stay secure while your AI tools get smarter.

FAQs

Is Granola's MCP available on the free plan?

Yes, MCP works on all Granola plans, including Basic at $0/month.

What is the default access for enterprise members?

Access depends on the workspace’s current MCP configuration. If neither scope is enabled, members have no MCP access until an admin enables personal notes, public notes, or both.

Does Granola store my meeting audio?

No. Granola captures device audio, transcribes it in real time, and deletes the audio immediately after the meeting ends.

What is the difference between stdio and Streamable HTTP transport in MCP?

stdio runs entirely on-device via standard input/output streams with no network exposure, while Streamable HTTP uses an HTTPS connection secured with OAuth 2.0 authentication, which is the transport method Granola uses for its MCP integration.

Key terms glossary

Model Context Protocol (MCP): An open standard introduced in late 2024 that enables AI models to access data sources and tools through a client-server architecture with defined permissions. The AI application (host) creates MCP clients that connect to MCP servers, where data sources like Granola act as servers.

stdio transport: A local-only communication method using standard input and output streams, where no network connection is required and the server process terminates automatically when the client closes.

Streamable HTTP transport: The current MCP transport standard, using HTTPS with OAuth 2.0 authentication to secure connections between AI tools and data sources. This replaced SSE in the March 2025 MCP specification update.

SSE (Server-Sent Events) transport: An HTTP-based transport method, now deprecated in the MCP specification as of March 2025, that enabled MCP servers to run remotely over persistent network connections.

OAuth 2.0: An authorization standard that uses scopes to limit an application's access to a user's account. An application requests one or more scopes, which are presented to the user in a consent screen, and the access token issued is limited to the scopes granted. Granola's MCP integration requires OAuth 2.0 authentication for every connected tool.

SOC 2 Type 2: A security audit standard that verifies an organization's security practices meet defined criteria over a sustained observation period. Granola achieved SOC 2 Type 2 certification in July 2025.

Read-only permissions: An access model where a connected tool can retrieve and query data but cannot modify, overwrite, or delete it. Granola's MCP server operates read-only for all connected AI tools.